General
-
Target
2380-18-0x0000000000490000-0x00000000016E4000-memory.dmp
-
Size
18.3MB
-
MD5
df8f61e540c60c9a086c3bcb39afe084
-
SHA1
b32a41f5fab11e028b0472beb03131324561bfb8
-
SHA256
1a67ea5b1c4b308abeea7b0f5d91bd9fedf807249db5098717502426a4b0e70c
-
SHA512
b5fb173819af929624318747b424a6d091d9d2fecb0e342d4555063a052c827e3b69ba569b97735dee85eed5ac83b845cd0e3bd99112d858d750f823cd8e22d4
-
SSDEEP
12288:hGjXVMPIX9GZYKvuxblS2et4K6P0HsvZbTi+DY:YjXVMQX9IYKuk4K6PlZCs
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
RemoteHost
C2
191.101.51.117:11371
191.101.51.117:10050
191.101.51.117:10051
191.101.51.117:24554
191.101.51.117:2700
Attributes
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-XS1JNK
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2380-18-0x0000000000490000-0x00000000016E4000-memory.dmp
Headers
Sections